Efficient high-capacity quantum secret sharing with two-photon entanglement* 



00 

o 
o 

(N 

Oh- 
< 

in 

■ 

> : 
o . 
\o ■ 

<n : 
o . 

\o ■ 
o ■ 

^: 

Ok 

^— > ■ 

G ■ 
cd 

3 : 
cr. 



Fu-Guo Deng, 1 ' 2 - 3 ' 4 Xi-Han Li, 1 - 2 ' 3 and Hong-Yu Zhou 1 - 2 ' 3 
1 The Key Laboratory of Beam Technology and Material Modification of Ministry of Education, 
Beijing Normal University, Beijing 100875, People's Republic of China 
2 Institute of Low Energy Nuclear Physics, and Department of Material Science and Engineering, 
Beijing Normal University, Beijing 100875, People's Republic of China 

3 Beijing Radiation Center, Beijing 100875, People's Republic of China 

4 Department of Physics, Applied Optics Beijing Area Major Laboratory, 
Beijing Normal University, Beijing 100875, People's Republic of China 

(Dated: April 28, 2008) 

An efficient high-capacity quantum secret sharing scheme is proposed following some ideas in 
quantum dense coding with two-photon entanglement. The message sender, Alice prepares and 
measures the two-photon entangled states, and the two agents, Bob and Charlie code their informa- 
tion on their photons with four local unitary operations, which makes this scheme more convenient 
for the agents than others. This scheme has a high intrinsic efficiency for qubits and a high capacity. 
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Quantum entanglement offers some novel ways for in- 
formation processing and transmitting securely [l[, such 
as quantum computation [H, quantum teleportation 
quantum key distribution (QKD) [S H @, 0, 

quan- 
tum dense coding quantum secure direct communi- 
cation (QSDC) [E [l(|, and so on. A surprising property 
of an entangled quantum system is its nonlocality. Two 
parts of the quantum system cannot be considered to be 
independent even if they are far apart, and the single- 
particle measurements on these two parts cannot give all 
the information about the state of the whole quantum 
system. Quantum nonlocality has been embodied in the 
process of quantum teleportation [2j , an important quan- 
tum technique. Ekert exploited the nonlocality feature to 
design a QKD protocol in 1991, and Bennett, Bras- 
sard and Mermin (BBM92) Q simplified its error rate 
analysis process in 1992. Also, quantum nonlocality has 
been used to transmit a secret message directly [S [l(| • 

Secret sharing is a classical cryptographic scheme [ill, 
US [H[ in which a boss, say Alice suspects that one of 
her two remote agents, say Bob and Charlie, may be 
dishonest but she does not know who the dishonest one 
is. She believes that the honest agent can prevent the 
dishonest one from destroying her benefits if they act 
in concert. For the security of her message Ma, Alice 
splits it into two pieces Mb and Mc, and sends them 
to Bob and Charlie, respectively. The two agents can 
read out the message Ma = Mb © Mc only when they 
cooperate. As a classical signal can be copied perfectly, it 
is impossible to create a private key with classical physics. 
When quantum mechanics enters the field of information, 
the story is changed. Quantum secret sharing (QSS) is 
the generalization of classical secret sharing into quantum 
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One of the main goals of QSS, similar to QKD, is 
to distribute the private keys among the three partic- 
ipants, or more generally, many participants securely 
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original QSS scheme was proposed by Hillery, Buzek and 
Berthiaume in 1999, which is called HBB99 hereafter. 
In the HBB99 scheme [14j |. the secret sharing is accom- 
plished by using a three-photon entangled Greenberger- 
Horne-Zeilinger (GHZ) state. Each participant holds a 
photon from a GHZ state, and chooses randomly one 
measuring-basis (MB) from the X-MB and the F-MB to 
measure their photons independently, similar to BBM92 
QKD scheme [J]. Subsequently Karlsson, Koashi and 
Imoto (KKI) put forward another QSS scheme [IS] with 
a two-photon polarization-entangled state. The photons 
are polarized along the z or x directions, and the two 
agents measure their photons choosing randomly one of 
the two MBs, Z and X. The efficiency for qubits r) q = ^ 
in these two protocols 0, [l5[ is 50% because half of the 
instances arc discarded as the participants choose incom- 
patible MBs, similar to the BBM92 QKD protocol 0]. 
Here q u is the useful qubits and qt is the total qubits 
transmitted [S l34j . Each entangled quantum system can 
be used to carry on average a half bit of the random 
common key, and two or more bits of classical communi- 
cations are required to compare the correlation of their 
MBs. Their total efficiency 774 is low; 77 is defined as [oll34j 
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where b s , q t and bt are the number of bits in the raw 
key, the qubits transmitted, and the total classical bits 
exchanged between the participants in the quantum com- 
munication, respectively. For instance, the total effi- 
ciency in HBB99 QSS scheme [lij with three parties is 
at most rjt = — 12.5% as the three parties trans- 
mit a two-qubit (i.e., two particles in a three-particle 
GHZ state) quantum system to create half bit of key 
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at the expense of exchanging at least two bits of classical 
information about their MBs. That is, Alice and Bob 
(or Charlie) exchange a bit of information about Bob's 
(Charlie's) MB, i.e., b t = 2. In KKI QSS scheme [3 
with three parties, the parties use a two-qubit quantum 
system to obtain half bit of key in principle, i.e., its total 
efficiency is at most i] t = = 12.5%. 

In this Letter, we present an efficient high-capacity 
QSS scheme for distributing a random key among three 
participants with a two-photon entangled state based on 
quantum dense coding. The two agents, Bob and Charlie 
choose the single-photon measurements on the sampling 
photons with the three MBs Z, X and Y randomly for 
eavesdropping check, and encode their information with 
four local unitary operations on their photons. Almost 
all the entangled states can be used to exchange the ran- 
dom key and each two-photon entangled state can carry 
two bits of information. Moreover, this scheme is se- 
cure with the decoy photons and the classical informa- 
tion exchanged is reduced largely as the participants al- 
most need not compare their MBs for all the instances 
except for those for eavesdropping check. The efficiency 
for qubits i] q approaches 1 and the total efficiency r\ t 
approaches 50% (neglecting the instances for checking 
eavesdropping, same as those in other QSS schemes) as 
the two qubits are transmitted double the distance be- 
tween the sender Alice and her agents, which equals four 
qubits are transmitted in the KKI QSS scheme, and two 
bits of key are created in theory. 

An Einstein-Podolsky-Rosen (EPR) pair is in one of 
the four Bell states shown as follows. 
1 
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where | + z) = |0) and | — z) = |1) are the eigenvectors 
of the MB Z (for example the polarizations of a photon 
along the z-direction), and | + x) = -^(|0) + |1)) and 

| - x) = ^(|0) - |1)) arc those of the MB X. The 
subscripts B and C indicate the two correlated photons 
in each Einstein-Podolsky-Rosen (EPR) pair. The four 
local unitary operations Ui {i = 0, 1, 2, 3) can transform 
one of the Bell states into another, 

U =/=|0)<0| + |l)<l|, 

Ux =a z = \0)(0\-\l)(l\, 

U 2 =(r x = |l)(0| + |0)<l|, 

Us =» O - y = |0)(l|-|l)<0|, (3) 

where / is the 2x2 identity matrix and c; (i — x, y, z) 
are the Pauli matrices, i.e., 



U^) = \4> ± ), 



itoUM*) =-|V T ), itoUity*) = |0 T ), 

I®U 3 \^) = \^), I®U 3 \^} = ~\^). (4) 

The four Bell states can be used to carry two bits 
of classical information 0, Q, but we cannot send the 
photon pair directly into an insecure channel as the four 
Bell states are the the simultaneous eigenvectors of the 
two-body operators {ai B ^ai C \ ai^a^} and they can 
be copied freely, which renders the transmission insecure. 
To prevent an eavesdropper Eve from eavesdropping, one 
way is not allowing Eve to acquire simultaneously both 
photons in each EPR pair, such as those in the two-step 
quantum communication scheme @, Q and its variant 
[lfj |. Another method is to change the order of a group 
of EPR pairs with two quantum channels so as to con- 
fuse Eve the correct matching of the photons in the group 
of EPR pairs, for instance that in the controlled-order- 
rearrangement-encryption technique for QKD Q ■ 

In QSS, if the participants can prevent the dishonest 
agent, say Bob, from eavesdropping the quantum chan- 
nel freely, any eavesdropper can be found out [l5| . Sim- 
ilar to Ref. [15j, Alice can prepare each photon pair in 
one of the nonorthogonal entangled states, which will 
forbid the dishonest one to copy the quantum system 
without disturbing it. To the end, Alice should pick out 
two nonorthogonal bases to prepare the entangled pho- 
ton pairs, similar to Bennet-Brassard 1984 (BB84) QKD 
protocol [351 ] . Certainly, one set of basis for an entan- 
gled photon pair is the four Bell states, shown in Eq @. 
Another set of basis can be chosen as follows. 
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where | ± y) — -^(|0) ± i|l)) are the two eigenvectors 

of the MB Y. The four local unitary operations f/j (i = 
0,1,2,3) can transfer one of the four entangled states 
{l^), |* ± )} into another, i.e., 
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The two basis sets {l^), IV^)} and {I*" 1 "), I*" 1 ")} are not 
orthogonal, which forbids any one to copy them perfectly, 
same as that in Ref. [la ]. 

Now, let us describe the principle of our QSS scheme 
in detail as follows. 

(1) . Alice, Bob and Charlie agree that each of the four 
local unitary operations Uq, Ui, U 2 and U 3 represents the 
two-bit information. 

(2) . Alice prepares the two photons B and C in one 
of the eight nonorthogonal entangled states {l^), 
\<& ± ), \^ ± )} randomly. She sends the photon B to Bob 
and C to Charlie. 

For preventing the dishonest agent from eavesdropping 
freely with an opaque attack [3y|, Alice sends a decoy 
photon [37], [HI , which is randomly in one of the six states 
{\Q),\l),\+x),\- x),\+y),\- y)}, to each agent with 
the probability pd (we give the reason for choosing decoy 
photons below). Alice can prepare the decoy photon by 
measuring one photon in the two-photon quantum sys- 
tem which is in one of the two states {|</> + ), | < 1 )+ )} with 
the MB a z [Hj]. Also, she can produce it with an ideal 
single-photon source [3?], H|[ . 

(3) . Bob and Charlie choose one of the two modes, 
a small probability p c (< 1/2) with the checking- 



eavesdropping mode and a large probability 1 — p c with 
the coding mode, for their photons received, similar to 
those in the Refs. 0, E3, GUI . 

If Bob (Charlie) chooses the checking-eavesdropping 
mode, Bob (Charlie) measures his photon by choosing 
one of the three MBs Z, X and Y randomly; otherwise, 
Bob (Charlie) encodes his random key on the photon 
received with one of the four unitary operations {U} 
(i = 0, 1,2,3). He sends the photon back to the sender 
Alice. 

(4) Alice takes a Bell-basis measurement on each 
two correlated photons received from Bob and Charlie 
with the two-photon entanglement basis {l^), |V' ± )} or 
H"!^), | V I' ± )}, as the same as that she prepares them be- 
fore the communication. 

As the operations done by the agents on the quantum 
system composed of the photons B and C do not change 
its basis, the measurement done by Alice is deterministic 
and will give out the outcome of the combination of the 
unitary operations performed by Bob and Charlie, say 
U a = Ub®Uc- Here Ub and Uc are the operations done 
by Bob and Charlie, respectively. If the communication 
is secure, each of the four unitary operations represents 
two bits of classical information which can be used as the 
raw key in QSS. 

If one of the two agents, say Bob, measures his photon 
and the other agent (Charlie) sends his photon back to 
Alice, instead of encoding it, Alice will get nothing with 
her Bell-basis measurement. 

(5) . Alice tells her agents which entangled basis has 
been chosen for each EPR pair and completes the error 
rate with the helps of her two agents. 

She requires Bob and Charlie to publish the MBs and 
the outcomes of the sample photons for which they choose 
the checking-eavesdropping mode. Alice exploits the re- 
fined error analysis technique *40| for checking eavesdrop- 
ping of the process of the transmission from Alice to her 
agents. That is, Alice only picks up the decoy photons 
measured by the agents to check eavesdropping. As the 
agents measure the decoy photons with the three MBs, 
Z, Y and X, the probability that the outcomes of the 
agents' are correlated with those of Alice's is ^PdP c - Sim- 
ilar to Ref. [40T |. this eavesdropping check will find out 
the eavesdropper monitoring the quantum channel from 
Alice to her agents as any eavesdropping will leave a trace 
in the outcomes of the decoy sampling photons. 

For preventing the dishonest agent from eavesdropping 
the process from the other agent to Alice freely, Alice 
should also pick out randomly a sufficiently large sub- 
set of the outcomes from the Bell-basis measurements on 
the entangled quantum systems, and analyzes its error 
rate, named it as the second check. It is useful for check 
the security of the quantum channel when the photons 
run from the two agents back to Alice. Moreover, it can 
provide an estimate information for the postprocessing, 
such as the error correct and the privacy amplification. 
For half of these instances, Alice requires Bob first pub- 
lish his operations and then Charlie, or vice versa. 
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(6). If all the error rates are low than the threshold 
e t h, they can use the results remained as a raw key and 
distill a private key Ka = Kb © Kc with error correction 
and privacy amplification [5j; otherwise, they will aban- 
don the outcomes transmitted and repeat the quantum 
communication from the beginning. 

It is of interesting to point out the advantages that 
Alice replaces some photons in the Bell states with the 
decoy photons [37l Ha] . If Alice does not exploit the de- 
coy photons, a dishonest agent, say Bob can steal some 
information with an opaque attack freely and fully [3(|, 
especially when the transmission efficiencies lower than 
50%. In detail, Bob intercepts the photon C when it is 
sent from Alice to Charlie, and stores it with a quantum 
memory. He prepares a fake EPR pair B'C in the state 
\<P + )b>c> = 75(1 + z)b>\ + z)c> + I - z)b>\ - z)c) and 
sends the photon C to Charlie, instead of the photon C. 
If Charlie operates the photon C and sends it back to 
Alice, Bob can capture this photon and take a Bell-state 
measurement on the photons B'C . He can obtain all the 
information about the operations done by Charlie in this 
way. On the other hand, if Charlie measures the photon 
C with the MB Z, X or Y, Bob will get no photon in 
the quantum signal sent from Charlie to Alice. He can 
determine this condition with a quantum non-demolition 
measurement, as same as that in Ref. [E |39| . Subse- 
quently, Bob can keep the photon B only when he gets 
the outcome \4> + )b'c- In this way, Bob's eavesdropping 
introduces no errors in the outcomes of the measurements 
done by Bob and Charlie (or Alice and Charlie) no matter 
what the MB chosen by Charlie is (36[. Certainly, Bob's 
eavesdropping will introduce errors in the outcomes if 
Bob gets the other three Bell-basis results. However, Bob 
can hide his eavesdropping with cheating (36[. That is, he 
can announce that he gets nothing when he measures the 
photon B as there are losses in the quantum line [36| . On 
the other hand, without the decoy photons, Alice should 
measure one EPR particle when the other EPR particle 
is measured by her agent. For accomplishing this task, 
she should first judge the photon number in each sig- 
nal sent back by each agent, which will require Alice to 
have the capability of taking a quantum non-demolition 
measurement. 

The process of eavesdropping check with decoy pho- 
tons between Alice and Charlie does not require Bob to 
participate in it, which will forbid Bob eavesdrop the 
quantum channel from Alice to Charlie with an opaque 
attack strategy [36| . The same process takes place be- 
tween Alice and Bob. In essence, the process of the pho- 
ton transmission from Alice to her each agent is similar 
to the QKD protocol proposed by Lo et al. which is 
proven to be secure. That is, this process can be made 
to be secure, same as QKD |35ll40j. 

After the operations done by the agents, the density 
matrix of the quantum system composed of the photons 
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honest agent, and he cannot copy the quantum signal 
freely, similar to BB84 [35] and BBM92 g| QKD proto- 
cols. So this QSS scheme can be made to be secure, 
which is in principle different from the QSS schemes 
El EE EE El 03 HI HI HI in which the process 
of checking eavesdropping is completed with the coop- 
eration of the dishonest agent. On the other hand, as 
the security of the process of the transmission from Al- 
ice to her agents is ensured with the decoy photons and 
that from the agents to Alice is ensured with the sam- 
ples of the outcomes obtained with Bell-basis measure- 
ments, this QSS scheme does not require the participants 
to have the capability of storing quantum states. As for 
the multi-photon attack [2l|, the agents can use a filter 
to prevent a fake photon with a nonstandard wavelength 
from entering their devices and use some beam splitters 
to split the sampling signals chosen for eavesdropping 
check before they measure the signals with the MB Z, 
X or Y, same as that in Ref. [4l|. Also, the parties can 
complete a faithful qubit transmission against collective 
noise with the technique in Ref. ,45| , which will improve 
the practical efficiency in this QSS scheme. 

Without the decoy photons prepared by Alice, this 
QSS scheme can be made secure if both Bob and Charlie 
have an ideal single-photon source. In detail, when Bob 
(Charlie) chooses the checking-eavesdropping mode, he 
measures the photon B (C) sent by Alice with one of the 
three bases Z , X, and Y, and then sends a photon pre- 
pared by himself to Alice. This photon can be randomly 
in one of the six states {] ± z), | ± x), | ± y)}. In this 
way, the eavesdropper does not know which is the sam- 
ple photon before Alice receives the entangled EPR pair, 
and the opaque attack can be overcome as Alice can use 
the photons inserted by her agents to check the security 
of the transmission of photons from the agents to Alice. 
In essence, the honest agent prepares the decoy photons 
and uses them to prevent the potentially dishonest agent 
from eavesdropping freely. 

In fact, this QSS scheme is the modified version of the 
KKI QSS scheme [l5[ with quantum dense coding and 
decoy photons. But only those modifications increase its 
intrinsic efficiency, the source capacity and the security 
largely. Almost all the instances ((1 — P<z)(l — Pc) 2 ) are 
useful for generating the raw key except for those cho- 
sen for eavesdropping check, and each of the two-photon 
entangled quantum system can carry two bits of infor- 
mation. Moreover, the classical information exchanged 
is reduced largely as the two agents need not publish 
their MBs when they choose the coding mode with the 
four local unitary operations. Then the efficiency for 
qubits ?y 9 = (1 — P f /)(1 — P c ) 2 approaches 1 when Pd 
and P c are very small. As the two qubits in the entan- 
gled states are transmitted double the distances between 
the sender Alice and her agents, which equals to that 
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Alice and her agents transmit four qubits, the total ef- 
ficiency r\ t = | Q—E^kpl-A i n the present QSS scheme, 
approaching 50% when Pd and P c are very small. Cer- 
tainly, in a practical application with a noisy quantum 
channel, the efficiency for qubits cannot approach 1 and 
the total efficiency is low than 50% as the probabilities 
Pd and P c cannot be arbitrarily small. The parties can 
exploit error-avoiding codes to reduce the effect of noise 
on the efficiencies, such as the faithful qubit transmission 
technique with linear optics [42j]. 

In summary, we introduce an efficient high-capacity 
QSS scheme with quantum dense coding based on two- 
photon entangled states. The two agents, Bob and Char- 
lie choose the single-photon measurements on the sam- 
pling photons with the three MBs randomly for eaves- 
dropping check, and encode their information with four 



local unitary operations, which make this QSS scheme 
more convenient for the agents than some others [3, EH . 
Almost all the entangled photon pairs can be used to ex- 
change the random key and each photon pair can carry 
two bit of information. The intrinsic efficiency for qubit 
is double as that in KKI QSS scheme [15j|, and the source 
capacity is four times as the latter with the photons run- 
ning forth and back. Moreover, this scheme is secure with 
decoy photons and the classical information exchanged 
is reduced largely as the participants almost need not 
compare their MBs for all the instances except for those 
for eavesdropping check. As the efficiency for producing 
three-particle entangled state is low than that for two- 
particle entangled state, the present QSS scheme is more 
practical with present technology than the first one pro- 
posed by Hillery, Buzek, and Berthiaume |14j . 
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